Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Edge Security & Attestation”
Secure Boot Chain
Each boot stage verifying the signature of the next before executing it, anchored in immutable hardware, so only authorised software runs.
Build Attestation
A signed statement about how an artifact was produced — by which builder from which source — that a deployment gate can verify rather than trust.
Cold Start at the Edge
The initialisation delay when a request reaches a location with no warm instance, which at the edge occurs far more often because traffic is spread across many locations.
Content Security Policy
A response header declaring which sources of script, style and other resources the browser may load, which turns a script injection from a compromise into a blocked request.
Edge Aggregation
Summarising or filtering telemetry at the device or gateway so that only what is needed leaves, which is usually the difference between a viable and an unaffordable design.
Edge Function
Code executed at a CDN point of presence close to the user, in a constrained, fast-starting runtime, typically to modify or route a request before it reaches an origin.
Edge Personalisation
Varying a cached response at the edge on a small number of attributes, so the page stays cacheable while still differing per visitor segment.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Security Group
A stateful, instance-level firewall that allows specified traffic and denies everything else by default.
Security vs Usability
A trade-off that is usually resolved by varying the control with the value of the action, rather than by choosing a uniform level of friction.
Shift-Left Security
Moving security checks earlier so findings arrive while the author still has context, on the condition that the signal-to-noise ratio justifies it.
Admission Control
Deciding at the edge whether to accept a request at all, based on current capacity, before any work is done on it.
Ambassador Pattern
A helper process that handles outbound network communication on behalf of an application, adding retries, routing, security and telemetry without changing it.
Artifact Signing
Cryptographically signing build outputs so that deployment can verify what is being run was produced by the expected pipeline from the expected source.
Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Auditability
The ability to reconstruct who did what, to which resource, when, and from where — reliably enough to be relied upon after the fact.
Authentication
Establishing who a principal is, to a defined level of confidence.
Authorization
Deciding whether an authenticated principal may perform a specific action on a specific resource.
Blast Radius
The set of things that break, or become reachable, when one component fails or is compromised.
Blast Radius Reduction
The set of deliberate partitions — accounts, regions, zones, cells, tenants, deployment stages — that bound how far any single failure or compromise can reach.
Cache Penetration
Repeated lookups for keys that do not exist, which miss the cache every time by definition and pass straight through to the store.
Compliance Framework
A published set of control requirements an organisation is assessed against, which turns security posture into evidence somebody else will check.
A team proposes moving an API to edge functions to reduce latency for international users. What do you check before agreeing?
Where is the data? This is the question that settles most edge proposals. Compute at the edge that calls back to a single region database has moved the compute
A team proposes moving personalisation to edge functions to cut latency. When does that work and when does it backfire?
The principle that decides it The edge is near the user and far from your data. Edge compute pays off for work that needs the request but not your state . The m
Security requires default-deny egress across the estate. Engineering says it will cause constant outages. How do you deliver it?
Why security is right Inbound is default deny nearly everywhere. Outbound is usually wide open, on the reasoning that traffic originating inside is trusted. Tha
Security wants mandatory hardware keys for every login; the business says it will cost conversions. How do you resolve it architecturally rather than by picking a side?
What the interviewer is testing Whether you treat security as a fixed dial to be turned up, or as a risk proportionate design variable. Both stated positions ar
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Your JWT-based auth means a fired employee keeps access for 15 minutes after their account is disabled. Security says that is unacceptable. What are the options?
Why the gap exists A signed JWT is validated locally from its signature. That is the whole benefit — no network call, no shared session store, resource servers
Your organisation is preparing for its first SOC 2 audit. The security team is asking engineers for screenshots of configurations. What would you change, and what is the architectural argument?
What is wrong with screenshots Three things, and each is worth naming separately. They evidence a moment , not a period. The auditor is assessing whether contro
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
A critical CVE is announced in a widely-used library. Walk me through the first four hours.
Hour 1 — determine exposure Query the SBOMs across the estate , including transitive dependencies. This is the moment that justifies having them: without, this
A team is about to launch a public GraphQL API. What must be in place before it goes live?
Query cost control — the security requirement An arbitrary query language exposed publicly means a client can construct a query that consumes unbounded resource
Anomalous access to a customer database is detected. Walk me through the first day, and say what determines whether you can answer the regulator.
The first hours Declare an incident and assign command. Named commander who does not debug, operations lead, communications lead, scribe. Security incidents add
Edge Security & Attestation
Secure boot, hardware roots of trust, and proving what is running on a device.
Edge Compute Topologies
Regional, metro, on-premises and on-device, and what each tier is genuinely for.
Edge Computing
Moving compute towards the user, and what cannot follow it.
Edge Data Consistency
Replicated read state at hundreds of locations, and writes that still go to one.
Edge Functions
Short-lived compute at the CDN, its runtime limits, and what must stay at origin.
Edge Rendering
Running the render close to the user, and the personalisation and cache trade it implies.
Edge, Mobile & IoT
General material on architecture beyond the data centre boundary.
Firewalls & Security Groups
Default-deny, stateful rules, and restricting egress as well as ingress.
Frontend Security
CSP, XSS, CSRF, token storage, and the trust boundary that ends at the browser.
Network Security
Segmentation, egress control and limiting lateral movement.
Row & Column-Level Security
Restricting slices of a table rather than the whole table, and where it is enforced.
Security Architecture
General material on securing an architecture.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Security Incident Response
Detection, scoping, containment and notification clocks.
Security Testing in the Pipeline
SAST, DAST, dependency and secret scanning, and what to do with the findings.
Security vs Usability
Varying control by the value of the action rather than uniformly.
Supply Chain Security
Dependencies, SBOMs, build provenance and artefact signing.
Auditability
Tamper-evident, attributed records that survive async boundaries.
Authentication
Establishing who a principal is, and how strong that claim needs to be.
Authorization
RBAC, ABAC and ReBAC, and centralising the decision but not the enforcement.
CRDTs
Data types that converge without coordination, and the semantics you must accept.
Cloud Governance
Preventive policy, tagging, quotas and cost and security guardrails.
Edge, Mobile & IoT
Systems whose components you cannot reach, reboot, or assume are connected.
Security Architecture
Think in threats and trust boundaries rather than in security products.
AI-Era Architecture
AI workloads meeting security, data, networking, reliability and cost.